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Recently, Ambainis gave an 0(iV 2 ' 3 )-query quantum walk algorithm for element distinctness, and 
more generally, an 0(A/" i /' L+1 ' ) )-query algorithm for finding L equal numbers. We point out that 
this algorithm actually solves a much more general problem, the problem of finding a subset of size 
L that satisfies any given property. We review the algorithm and give a considerably simplified 
analysis of its query complexity. We present several applications, including two algorithms for the 
problem of finding an L-clique in an iV-vertex graph. One of these algorithms uses 0(N 2L ^ L+1 ^) 
edge queries, and the other uses 

(5( j V (5L-2)/(2L + 4) )) which 

is an improvement for L < 5. The latter 
algorithm generalizes a recent result of Magniez, Santha, and Szegedy, who considered the case 
L — 3 (finding a triangle). We also pose two open problems regarding continuous time quantum 
walk and lower bounds. 



I. INTRODUCTION 

In this paper, we address the following rather general 
query complexity problem: 

Problem (L-subset finding). 

Input: (i) Black box function f : D — > R, where the do- 
main D and the range R are finite sets, and \D\ = 
N is the problem size, (ii) Property V C (D x R) L . 

Output: Some L-subset {x±, . . . ,Xl} C D such that 
((x 1 J(x 1 )),...,(x L J(x L ))) e V, or REJECT if 
none exists. 

In the general case, for the purpose of query complexity, 
we can assume that the property V is given explicitly as a 
list. However, for specific versions of this problem, there 
will generally be a much more compact way to specify 
the property. 

The quantum query complexity of the L-subset finding 
problem is well- understood in the cases L = 1,2. The 1- 
subset finding problem is nothing but the well-known un- 
structured search problem. This problem can be solved 
in 0(s/N) queries 0, which is optimal Q- The element 
distinctness problem (see 3] and references therein) is a 
particular case of 2-subset finding. This problem can be 
solved using 0(N 2 ' 3 ) queries using a recent algorithm of 
Ambainis Q , which is also optimal [E IE • 

In Q, Ambainis also gave an 0(N L ^ L+1 ^)-query al- 
gorithm for the L-element distinctness problem, where 
the goal is to find L inputs that give the same out- 
put. This is a particular case of L-subset finding with 
V = {{{xi,y), . . . , (xL,y))}. However, the algorithm is 
actually even more general: it solves the L-subset find- 
ing problem using 0(N L / lyL+1 ^) queries, regardless of V. 
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We review the algorithm in this context in Section^] We 
also present a simplified proof that the algorithm works 
m Section HTT1 

Note that for L-element distinctness, any L-subset of 
inputs can potentially satisfy V, so we could have de- 
scribed V as a subset of R L . Many variants of element 
distinctness could also be described this way. However, 
for other problems such as finding a clique in a graph, we 
require the generality provided by letting V C (D x R) L . 

Because the property V can be any subset of (D x R) L , 
the subset finding algorithm can be applied to a wide va- 
riety of related problems. We discuss some of these appli- 
cations in Section lTvl In particular, we consider using the 
algorithm to find L- vertex subgraphs in N- vertex graphs, 
assuming the graph is given as a black box allowing edge 
queries. The most straightforward application of the L- 
subsct finding algorithm gives an 0(iV 2L /( L+1 ))-query al- 
gorithm for finding an L-clique. This upper bound is 
the best we know for L > 6. However, for L < 5 we 
improve it to 0( J /V' 5L-2 )/( 2i+4 )) using the recursive ap- 
proach of 0, which considers the particular case L = 3 
(finding a triangle). 

We conclude in Section El by suggesting some open 
problems. We discuss why the subset finding algorithm is 
well-suited to discrete rather than continuous time quan- 
tum walks, and we pose an open problem related to the 
simulation of continuous time quantum walks. We also 
discuss the known lower bounds for L-subset finding, and 
we suggest a specific case where the subset finding algo- 
rithm might be optimal for general L. 

II. ALGORITHM 

In this section, we review Ambainis's algorithm for ele- 
ment distinctness [4| in the context of subset finding. The 
algorithm is based on the idea of a discrete time quan- 
tum walk on a graph |ToL UlL IT2I Il3j . A quantum walk is 
simply a way of formulating local quantum dynamics on 
a graph. If the walk takes discrete steps that only move 
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amplitude between neighboring vertices, then in general 
the walk must include an ancillary state space jlO( , some- 
times referred to as a "coin," that can be used to indicate 
the direction of the next step of the walk. Thus the quan- 
tum walk can be built as a sequence of transformations, 
some of which act on the coin register and some of which 
use the state of the coin register to update the location 
in the graph. 

The graph used in Ambainis's construction is a bipar- 
tite graph whose vertices are all subsets of the domain 
D of size either M or M + 1. We will choose M to be 
e(N q ) for some < q < 1 (recall \D\ = N). Let A C D 
with |A| = M, and let B C D with \B\ = M + 1. Ver- 
tices A and B are connected in G iff \A PI B\ = M, i.e., 
B = A U {k} for some k € D \ A. 

To define the quantum walk on G, we define an or- 
thonormal basis of quantum states \ A), one for each sub- 
set A. For any subset A with |A| = M, there are M 
associated function values f(A) £ R M , and similarly, for 
any subset B with \B\ = M + 1, there are M + 1 as- 
sociated function values f(B) £ R M+1 . A key idea of 
the algorithm is to store these function values along with 
the subset. The only parts of the algorithm that require 
queries will be those that manipulate the function values. 

The full state of the quantum computer has the form 
\A, f(A), k) where \A, f(A)) is the state described previ- 
ously, including the function values, and \k) is the coin 
register, where k € D. If \A\ = M then k indicates an 
element to be added to A, so we must have k £ A. Sim- 
ilarly, if \B\ = M + 1 then k indicates an element to be 
removed from B, so we must have k S B. 

One step W of the quantum walk (which actually in- 
volves two steps on G) is a product of four unitary trans- 
formations, W — SC2SC1. The shift operation S acts 
as 

S\A, f(A), k) = \AU {k}, f(A U {k}), k) (1) 
S\BJ(B),k) = \B\{k}J(B\{k}),k) (2) 

and can be implemented using one query of the black 
box. The coin operations C\ and C2 are Grover diffusion 
operators on k ^ A and k 6 B, respectively. In other 
words, we have 



Cx\A,f{A),k) = \A,f(A),k) 
2 



N-M 

k't^A 

Ci\B,f(B),k) = \B,f(B),k) 



J2\Af(A),k>) (3) 
(4) 



and 



(5) 



C 2 \A,f(A),k) = \A,f(A),k) 
C 2 \BJ(B),k) = \BJ(B),k) 

2 - \B,f(B),k'). (6) 



M ■ 



k'eB 



These unitary transformations do not change the sub- 
set, so they also do not affect the function values, and 
consequently do not require any queries. 



The algorithm also involves a phase flip operation that 
distinguishes subsets A that include an L-subset satisfy- 
ing V . For simplicity, we suppose there is exactly one 
special subset S = {x%, . . . , xl} C D of inputs such that 
((xi,/(xi)), . . . , (x L ,f(x L ))) e V. The general case can 
be handled by modifying the algorithm using standard 
sampling techniques 4]. The phase flip operation is 



P\A,f(A)) = 



-\AJ(A)) 
\AJ{A)) 



ScA 
S<£A. 



(7) 



Given A and f(A), the property V can be checked with- 
out any further queries of the black box, so no queries 
are required to implement P. 

The initial state for the algorithm is the symmetric 
state on subsets of size M, 



-L £ |A,/(A)>5», 

V \A\=M kt£A 



(8) 



where c = ({^) (N—M) is a normalization constant. This 
state can be made using M queries to the black box. 

The full algorithm is {W ll P) t2 , which uses 2t x t 2 ad- 
ditional queries, where t\,t2 will be determined in the 
analysis. Thus, using M + 2t\t2 queries, we produce the 
state (W tl P) t2 \s). Our goal is to choose ti,ia so that a 
measurement of this state is likely to provide a solution 
to the problem. 

Note that in the description of this algorithm, we have 
focused only on the query complexity of the various steps. 
For the algorithm to be efficient in terms of the number 
of computational steps as well as the number of queries, 
it must be possible to use A and f(A) to efficiently de- 
termine whether there is an {x\, . . . , xl} C A such that 
((xi,/(xi)), . . . , (x L J(x L ))) £ V. In doing so it may be 
helpful to maintain the function values in some particu- 
lar data structure, such as a hash table for the element 
distinctness problem (see Section 6 of 4J). However, for 
the general problem we will not be concerned with how 
V is given or how efficiently it can be checked. 



III. ANALYSIS OF THE ALGORITHM 

In this section, we give an analysis of the subset finding 
algorithm that is simpler, as well as tighter, than that 
of |4|. The main result is the following: 

Theorem 1. The quantum query complexity of L-subset 
finding is 0(N L ^ L+ V). 

To prove this theorem, we need to understand the spec- 
trum of W tl P, which we will see is close to a small ro- 
tation in a two-dimensional subspace spanned by \s) and 
a state that gives a solution to the problem. We will 
begin by proving Lemma |21 below, which characterizes 
the spectrum of the walk step W alone and shows how 
to choose t\. Then we will use techniques from 0] to 
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prove Lemma below, which describes the spectrum of 
W tl P and shows how to choose t 2 . Finally, we will give 
the proof of Theorem ^ 

To analyze the algorithm, we will use the fact that the 
evolution takes place in a (2L + l)-dimensional subspace 
of the full Hilbert space. Let Si — S and Sq = D \ S. 
Dchnc the states 



1 



\Af(A)) I*) 



(9) 



\A\=M 

|Ans|=j 



k^A 



for j = 0, 1, . . . , L — 1, p = 0, 1 and for j = L, p = 0, and 
the states 



\B 



1 



3,PI 



J2 \BJ(B))Y,\ k ) 



(10) 



3'P \B\=M+1 

\BnS\=j 



keB 
k£S v 



for j = 0, p = and for j = 1, . . . , L, p = 0, 1. Here the 
normalization constants are given by 



c 3-,o 



c?,i 



Ho 



N — L\ f L 
M-j){j 
N - L\(L 
M-j)\j 

N -L 



M + l-jJ\j 
N-L \ f L 



[(N - L) - (M - j)] 
(L-J) 

; 1 (m + 1 - j) = c jfi 



j 



K M + 1- jj \j 
In terms of these states, the shift operation acts as 

\Bj.o 



(11) 
(12) 

(13) 
(14) 



S\A jtl ) = \B j+ltl ) 
S\B jt0 ) = \Aj, ) 
S\B jtl ) = 



(15) 
(16) 
(17) 
(18) 



By explicit calculation, the coin transformations have the 
following matrix elements (with others determined by the 
fact that Ci,C2 are Hermitian as well as unitary): 



(^■olCil^-o) = l-2a(L-i) 

(^■olCxIA.-i) = 2^/a(L-j)[l-a(L-j)] 
(A j , 1 \C 1 \A JA ) = 2a(L-j)-l 

where a — l/(N — M), and 

(B jj0 \C 2 \B jfi ) =l-2pj 



(B jtl \C 2 \B j , 1 ) = 2pj-l 



(19) 

(20) 
(21) 



(22) 

(23) 
(24) 



where (3 = 1/(M + 1). 

Now we are ready to analyze the spectrum of the walk 
step W = SC 2 SCx. Similarly to Lemma 2 of 0, we find 



Lemma 2. The eigenvalues of W are 1 and 
exp[±i(2y/j/M + 0(1/M + 1/VN))] for j = 1,...,L. 
The eigenvector with eigenvalue 1 is \s), and the two 
eigenvectors with eigenvalues exp[±i(2y/L/M+0(l/M+ 
1/VN))] are -^(\A L _ hl ) ± i\A Lfi )) + 0{^WjN). 

In fact, the eigenvalues of \W — 1| are exactly and 
\J j(ci + (3 — joifi) for j = 1,2,..., L, but we will not re- 
quire this level of detail. 

Note that the notation \ip) — \<j>) + O(e) means — 
\<t>)\\ = O(e). Similarly, for operators X,Y we write X = 
Y + O(e) as shorthand for \\X - Y\\ = O(e). 

Proof. Direct calculation shows that |s) is an eigenvector 
of W with eigenvalue 1. 

To understand the rest of the spectrum, we can think of 
the walk as being composed of two parts, C\ and SC2S, 
each of which is a unitary transformation in the A sub- 
space. Let 



d = C + A 1 
SC 2 S = C + A 2 



(25) 
(26) 



where C is the diagonal matrix with diagonal elements 

(A j>p \C\A jtP ) = (-iy. (27) 

The matrices Ai,Aa each consist of L 2 x 2 blocks 
and one lxl block (a zero), so their eigenvalues can 
be computed explicitly, giving ||Ai|| = 0(1/ \/~N) and 
||A 2 || = 0(1/ VM). Now we have 

W = l + A 2 + OAi + A 2 Ai (28) 
= 1 + A 2 + 0(1/ VN) . (29) 

Therefore, it is sufficient to calculate the eigenvectors 
and eigenvalues of the matrix A 2 C, which has matrix 
elements 



(A jt |A 2 OK 0) = -2/3j 

(A jfi \A 2 C\A^ hl ) - -2^pJ(\~ 

(A^ hl \A 2 C\A J . o ) = 2^pJ0~ 
(A i _i,i|A a C|A J -_i, 1 ) = -2/3i. 



(30) 

(31) 
(32) 
(33) 



This matrix also has L 2 x 2 blocks and one lxl 
block, so its eigenvalues and eigenvectors can also be 
computed explicitly. Using perturbation theory to calcu- 
late the size of the small correction from the 0(1/ y/N) 
term, we find that the eigenvalues of W — 1 are and 
±2zy7/J + 0(1/ y/N) for j = 1, . . . , L, which implies the 
claim about the eigenvalues of W. The claim about the 
two relevant eigenvectors of W also follows by perturba- 
tion theory. □ 

Lemma shows that in W fl we want to take t\ = 
O(VM), since this choice implements a rotation by an 
angle of order unity. In fact, we choose t\ = |_§ yM/Ii\ , 
where [a?] denotes the nearest integer to x, so that the 
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two extreme eigenvalues of W fl are — 1 + 0(1/ vM) (here 
the domi nant source of error is actually the fact that 
77 \J Mj L may not be close to an integer). 

We now describe techniques for understanding the 
spectrum of W fl P. Essentially the same analysis appears 
in Section IV. A of , and we will follow that treatment 
closely. Our goal is to calculate spectral properties of an 
operator UP where P — 1 — 2\w)(w\. In our case U is 
W h , and P is given by Q, so that \w) = |Ae,,o)- 

An eigenvector \9 a ) of UP, with eigenvalue e a , satis- 
fies 

UP\9 a ) =(U- 2U\w)(w\)\6 a ) = e i9 «\6 a ) , (34) 



i.e., 

(U-e i0 «)\6 a ) = 2U\w)(w\6 a ) 

Define 

Ra = \(w\9 a )\ 2 

and choose the phase of \9 a ) so that 
(w\9 a ) = yfR~ a . 
As long as R a > 0, we may write 



(35) 
(36) 

(37) 
(38) 

Consistency with (|37|) then gives the eigenvalue condition 



1 - UU 



\w) = 1 



(39) 



Now let the eigenstates of U be \v,j) with eigenvalues e l 
Then the eigenvalue condition Ip^jl may be written 



St 



2|H»i)l 2 

_ gi(9 a — Uj) 



(40) 



The real part of this equation is automatically satisfied, 
and the imaginary part gives 



£|H%)| 2 cot - 



0. 



(41) 



Roots of this equation determine the values of 9 a , which 
specify the eigenvalues of UP. 

Similar considerations let us determine properties of 
the eigenvectors. The normalization condition on \9 a ) 
gives 

4 

Ra(w\- Tr , , fl lo |w) = 1 , 



|1 - [/t e i».|2l 



i.e.. 



Ra = 



M _ gi(ea-«,)|2 

j 1 
1 + ]T|M^}| 2 cot 2 



(42) 



(43) 



(44) 



To compute the overlap of \9 a ) on the eigenstates \uj) of 
U, we multiply Ij38(l on the left by (uj\, which gives 



(u J \9 a ) = (w\9 a )(u J \w) 



1 + i cot 



(45) 



Applying these techniques to our specific problem, we 
find 

Lemma 3. W tl P has two eigenvectors \9±) = 
-^{\w) ± i\s)) + 0(1 /M + M/N) with eigenvalues 

exp[±2i(M/A) L / 2 (l + 0(l/M + M/N))]. 

\Ala). The eigenvalue 



Proof. From Q, we have \w) 
condition for W ll P is 



=|( W | S )| 2 cot^+^|( w K)| 2 cot^- 

j¥0 



(46) 



We are interested in solutions where 9 a is small (which 
we will indeed find for large N), so Taylor expansion in 
9 a gives 



0=\(w\s}f 



0(1) 



Y^\Hu,)\ 2 cot^ + ^csc 



J2 



0(61 



(47) 



|H*>| 2 ^ + 0(1) 



J2 u 3 



pairs of j 



0(61)) (48) 



where in the second equality we have used the fact that 
the values Uj come in ± pairs, with identical values 
of |(u>|iij)| 2 , since W is a real unitary matrix. From 
Lemma |2 we see that the only nonnegligible contribu- 
tions to this condition come from |s) and the two eigen- 
states with \ (w\uj)\ 2 = \ + 0(M/N). We have 



0=IHs>|2 U +0(1) 

- Q + 0(M/N)\ 6 a [l + 0(1/M)] + 0(91) 
+ 0(M/N)0(9 a ), 
which gives two solutions, 

0± = ±2(w\s) + 0((M/N) 1+L/2 ) , 



(49) 



(50) 



where the leading order contribution as well as the error 
term follow from 



(w s 



\Jc~LflJc 



(N — L)\M\ 



Y N\(M-L)\ 
(M/N) L/2 [1 + 0(1/M)] 



(51) 

(52) 
(53) 
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Having found the eigenvalues of W tl P, we can now 
calculate its eigenstates. Applying Lcmma|2]to fl44| gives 

(w\6 ± ) = 4| + 0(1/M + M/N) , (54) 

and a similar calculation using (|45l) gives 

(s\0±) = ±4= + 0(1/M + M/N) , (55) 
v2 

which completes the proof. □ 

From Lemma [3J we see that we should choose ti = 
Lf (N/M) L / 2 } so that (VT^P)* 2 implements a rotation 
from |s) to a state near \w). 

We now complete the proof of the main result: 

Proof of Theorem^ Recall that h = [%-y/M/L] and 
h = Lf (N/M) L / 2 ]. From Lemma [3 it is easy to see 
that 

\{w\{W l1 P) t2 \s)\ 2 = \-0{l/M + M/N). (56) 

Therefore, a measurement of the state (W tl P) t2 \s) yields 
a subset A for which S C A, together with the associ- 
ated function values f(A), with probability close to 1. 
As discussed in Section [nj the state \s) can be prepared 
using M queries, and the rest of the algorithm uses 2tit2 
queries. Thus the total query complexity is M + 2t\t2 — 
0(M + N L / 2 M^' L y 2 ). Choosing M = L7V L/(L+1) 1 
shows that the algorithm uses 0(N L ^ L+1 ^) queries. □ 

Equation l|56|) can be contrasted with Lemma 3 of 4], 
which only shows that the success probability is O(l). 

IV. APPLICATIONS 

As discussed in |4|, the quantum walk subset finding 
algorithm solves a natural generalization of element dis- 
tinctness, the problem of finding L inputs to / that give 
the same output, using 0{N L ^ L+1 ^) queries. However, 
we have seen that the same algorithm finds L-subsets 
satisfying an arbitrary property V . Therefore, we can 
also solve many variants of L-element distinctness in 
0{N L ^ L+1 ^) queries — for example, finding a set of L 
consecutive function values, relatively prime function val- 
ues, or sum-free function values (no two of the L values 
sum to one of the other L values). 

A closely related problem is that of finding an L-clique 
in an iV-vertex graph given an edge query oracle. For 
L = 2 this is simply the problem of finding any edge in 
the graph, which is just the unstructured search problem 
on (^) items, and can be solved using O(iV) quantum 
queries. For L = 3 it is the problem of finding a triangle, 
for which the exact quantum complexity is not known. A 
straightforward Grover search on the ( 3 ) triples of ver- 
tices gives an algorithm that uses 0(7V 3 / 2 ) queries 



2L 5L-2 
L+l 2L+4 



2 


4 
3 


=1.333 


1 




3 


3 
2 


=1.5 


13 
10 


=1.3 


4 


8 
5 


=1.6 


3 
2 


=1.5 


5 


5 
3 


=1.667 


23 
14 


=1.643 



6 ^=1.714 |=1.75 

7 |=1.75 f|=1.833 



TABLE I: Query complexities of two algorithms for finding 
an L-clique in an iV-vertex graph. 

which was recently improved to 0(N 10 ^ 7 log 2 N) in pl| 
and subsequently to 0(A 13 / 10 ) in ||J. However, the 
best known lower bound is only £l(N), which follows by 
straightforward reduction from the unstructured search 
problem. For L > 3, the query complexity of L-clique 
finding seems not to have been widely studied. 

We describe two algorithms for finding L-cliques. One 
algorithm applies subset finding in a straightforward way, 
and another uses it recursively. The simple algorithm is 
faster than the recursive algorithm for large L (L > 6), 
and the recursive algorithm is faster than the simple al- 
gorithm for small L (L < 5). The simple algorithm is 
a straightforward application of the quantum walk sub- 
set finding algorithm where each subset A over which we 
walk consists of M vertices, and where the algorithm also 
stores all of the edges between them, i.e., their induced 
subgraph. The analysis of the algorithm proceeds as be- 
fore, except now initialization requires 0(M 2 ) queries 
to determine the subgraph, and each step of the walk 
requires 0{M) queries to compute (or uncompute) the 
edges incident on the newly added (or removed) vertex. 
The total number of queries is therefore 

0(M 2 + (N/M) L/2 x \[M x M) , (57) 

and choosing M = [jV L /( L+1 )] gives an overall query 
complexity of 0{N 2L ^ L+1 ^). This result is no better 
than straightforward Grover search for L = 3, but it gives 
results that are better than previously known algorithms 
for all fixed L > 4. 

However, we can improve upon this algorithm for 
L < 5 using the recursive approach from Here we 
again walk over induced subgraphs of M vertices, but 
now we search for a subgraph that includes L — 1 vertices 
from an L-clique in the full graph. Recall that to imple- 
ment the phase flip P we must determine whether a sub- 
graph satisfies this property. If the subgraph does satisfy 
the property, then either the L-clique lies entirely within 
the subgraph, or all but one of the L-clique vertices form 
an (L — l)-clique in the subgraph. If the clique falls en- 
tirely within the subgraph of size M, then no queries are 
necessary. Otherwise, if one of the vertices of the clique 
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falls outside the subgraph, then the clique can be found 
using a Grover search for the outside vertex, where each 
Grover iteration uses (L — l)-subset finding to identify 
the L—l vertices inside the subgraph of size M. The im- 
plementation of the phase flip P using this Grover search 
requires a total of r = 0{M^ L ~ 1 ^/ L ^/N) queries. Thus 
each of the t 2 = 0((iV/M)( L-1 V 2 ) iterations of W fl P 
uses queries, 
where M queries are needed for each walk step as in the 
simple algorithm above. Therefore, since 0(M 2 ) queries 
are required for initialization, the total number of queries 
is 

0(M 2 + {N/M) {L - 1]/2 {M {L - 1)/L ^/N + M 3/2 )) , (58) 

and choosing M = [N L ^ L+2 ^~\ gives an overall query 
complexity of 0(jv(5£-2)/(2L+4)^ 

The numbers of queries used by these algorithms for 
2 < L < 7 are summarized in Table [I] Of course the 
algorithms are not really specific to finding cliques, but 
could be used to find any desired subgraph consisting of 
L vertices. 

In all the applications mentioned in this section so far 
(with L > 3), the problem has some structure that may 
allow us to learn something about whether a given subset 
of fewer than L items could be part of an L-subset sat- 
isfying V . For example, in L-element distinctness, if we 
find two inputs with different outputs, we know these in- 
puts cannot be part of an L-subset of inputs that all give 
the same output. Similarly, if we find two vertices in a 
graph that are not connected by an edge, then we know 
that no triangle can include these two vertices. How- 
ever, such structure is not used by the algorithm; it can 
just as well solve a problem in which it is impossible to 
obtain any information about whether fewer than L in- 
puts might satisfy P. For example, consider the L-zero 
sum problem with D = {1, . . . , N}, R = {0, f } m , and 
V = {((x 1 ,y 1 ),...,(x L ,y L )) : y 1 @---®y L = m }; or 
alternatively, suppose R — {0, 1, • • • , q — 1} and V = 

{((x 1 ,y 1 ), . . . , (x L ,y L )) : y\ H h y L = (mod q)}. 

These particular L-subset finding problems seem to be 
examples of the hardest cases, since there is no way to 
determine anything about whether a subset of L — f in- 
puts might be part of an L-subset satisfying V . 



V. OPEN PROBLEMS 

The subset finding algorithm we have described is 
based on a discrete time quantum walk, but there is a 
more natural formulation of quantum walk as a continu- 
ous time process that avoids the need to introduce a coin 
register |16| . For the present application the coin register 
seems to be essential since it tells us what to query when 
we take a step. Nevertheless, we could consider a contin- 
uous time quantum walk (without a coin) on the Johnson 
graph J(N, M) whose vertices are all subsets A C D of 
size \A\ = M , and in which two vertices are connected if 



they differ in exactly one element. If we label the vertices 
A of J(N, M) with the corresponding black box function 
values f(A), and if we could simulate the continuous time 
quantum walk on this labeled graph efficiently enough, 
then we could have an algorithm that works in a simi- 
lar way to the search algorithm in [T^j . However, most 
of the techniques we currently know for simulating such 
a walk are based on edge coloring [171 Il8l Il9l |20| and 
do not work well when the degree is large. It is an open 
problem whether the walk on this graph can be simulated 
efficiently enough to give a competitive algorithm for the 
L-subset finding problem. 

It would be interesting to know which of the algorithms 
we have presented are optimal. For the L = 1 problem 
there is a well-known lower bound of £l(y/~N) that 
matches the performance of the subset finding algorithm. 
Of course for this problem the simpler Grover algorithm 
also achieves this query complexity 0. For L = 2 there 
in an f^iV 2 / 3 ) lower bound on element distinctness that 
follows by reduction from the collision problem d, IE S 
8]. Again this matches the performance of the subset 
finding algorithm Q . Therefore it is natural to conjecture 
an fi(iV L /( L+1 )) lower bound for the general L-subset 
finding problem. To be concrete, we propose 

Conjecture. The L- zero sum problem, i.e., the L-subset 
finding problem with domain D = {1, . . . , N}, range R = 
{0, l} m , and property V = {((xi,yi), (x L ,y L )) : y x © 
' "@Vl = m }, where m is some function of N, requires 
Q(N L /( L+1 * > ) quantum queries. 

While we believe this to be the case, the best lower bound 
we know is il(N 2 ^ 3 ), independent of L, for any L > 2. 

Of course, it would also be interesting to prove lower 
bounds for problems where something can be learned 
about subsets of size smaller than L, such as L-element 
distinctness or finding an L-clique in a graph. For the 
former it is not so clear whether the algorithm could be 
improved, whereas for the latter there is no particular 
reason to expect that the known algorithms are optimal 
for all values of L. 

Note added. After this paper was posted to the quant- 
ph archive, we learned through private communication 
that Magniez, Santha, and Szegedy independently con- 
sidered the problem of finding an L-vertex subgraph 
in an A^-vertex graph, and found an algorithm using 
0(A 2 ( L_1 )/ L ) queries. This result is now described in 
• In the context of the present paper, this can be seen 
by choosing M = [N^- 1 ^^ in ®. Note that this 
result subsumes the simple algorithm (|57|) . and also im- 
proves the 0(A( 5i ~ 2 '/( 2i+4 ))-query algorithm for L = 5. 
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